Testlie
Menu

API mocks

On this page

S3-compatible object storage

A mock of Amazon S3's REST API, path-style, for apps that point the AWS SDK at a custom endpoint as they would at MinIO. It covers:

  • buckets and objects;
  • real Signature Version 4 authentication;
  • checksums and server-side-encryption headers;
  • presigned URLs and presigned POST policies for browser uploads.

Testlie is not affiliated with Amazon Web Services, and nothing is encrypted with a real key.

Connect

Create an S3-compatible object storage system under No-code, and configure your client with:

  • endpoint: the base URL;
  • forcePathStyle: true;
  • the system's credentials.
Credential Environment variable
Access key id AWS_ACCESS_KEY_ID
Secret access key AWS_SECRET_ACCESS_KEY
Region AWS_REGION (us-east-1)
Bucket S3_BUCKET: a bucket that exists from the start
js
const s3 = new S3Client({ endpoint: "<base URL>", forcePathStyle: true, region: "us-east-1" });

For example, an app that takes an S3 endpoint and path-style flag (…_S3_ENDPOINT, …_S3_FORCE_PATH_STYLE=true) only needs those two settings and the credentials.

Operations
Buckets ListBuckets (GET /), CreateBucket (PUT /<bucket>), HeadBucket, GetBucketLocation
Objects PutObject, GetObject (with Range), HeadObject, CopyObject (x-amz-copy-source, x-amz-metadata-directive), DeleteObject
Listing ListObjectsV2: prefix, delimiter (CommonPrefixes), max-keys, continuation-token, start-after, encoding-type=url
Browser uploads POST /<bucket> with a presigned POST policy (createPresignedPost)

Authentication:

  • Every request is checked with AWS Signature Version 4 against the mock's access key, in the Authorization header or a presigned URL (X-Amz-Signature, X-Amz-Expires up to 7 days).
  • The request time must be within 15 minutes.
  • aws-chunked uploads, as SDKs send them with trailing checksums, are decoded. Their chunk signatures are not checked.
  • A presigned POST is checked by its policy signature and conditions: expiration, exact matches, starts-with, and content-length-range.

Checksums and encryption:

  • x-amz-checksum-sha256, x-amz-checksum-crc32 and x-amz-checksum-sha1, in headers, trailers or POST fields, are verified (BadDigest) and returned by HeadObject and GetObject with ChecksumMode: "ENABLED".
  • x-amz-server-side-encryption (AES256, aws:kms, with x-amz-server-side-encryption-aws-kms-key-id) is recorded and echoed.
  • ETags are the MD5 of the object.

CORS: preflights (OPTIONS) are answered for any origin, so a browser can post a presigned form.

Errors are S3's XML, e.g. <Error><Code>NoSuchKey</Code>…</Error>; HEAD errors have no body. The codes include SignatureDoesNotMatch, InvalidAccessKeyId, RequestTimeTooSkewed, AccessDenied, NoSuchBucket, NoSuchKey, BadDigest, EntityTooLarge and InvalidRange.

Limits

These limits apply:

  • 4 MB per object;
  • 1,000 objects and 50 MB per mock;
  • 10 buckets.

Not implemented:

  • multipart uploads (NotImplemented: use PutObject);
  • versioning, ACLs, bucket policies, lifecycle and tagging;
  • virtual-hosted-style addressing.

Object bodies that aren't text are summarised in the call log, never shown.